levanvn Goto Github PK

aes

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

apt32_deobfuscate

My scripts to deobfuscate APT32 malware

apt_digital_weapon

Indicators of compromise (IOCs) collected from public resources and categorized by Qi-AnXin.

asd

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

awesome-threat-intelligence

A curated list of Awesome Threat Intelligence resources

cobaltstrike

CobaltStrike's source code

code

my code

com-code-helper

Two IDAPython Scripts help you to reconstruct Microsoft COM (Component Object Model) Code

cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system

cuckoo-modified

Modified edition of cuckoo

cuckoomon

DEPRECATED - replaced with "monitor"

dreadnought

PoC for detecting and dumping code injection (built and extended on UnRunPE)

flare-on9-chal11_unpacking-pyarmor

My write-up for challenge 11 flareon 9: unpacking pyarmor

flareon10note

gh0st

a open source remote administrator tool

hollowfind

Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect and divert the forensic analysis techniques. The plugin detects such attacks by finding discrepancy in the VAD and PEB, it also disassembles the address of entry point to detect any redirection attempts and also reports any suspicious memory regions which should help in detecting any injected code.

immunitydebugger

ImmunityDebugger

injection

kernelbhop

Cheat that uses a driver instead WinAPI for Reading / Writing memory.

kernelreadwritememory

Simple code to manipulate the memory of a usermode process from kernel.

levanvn.github.io

malware

Malware Samples. Uploaded to GitHub for those want to analyse the code. Code mostly from: http://www.malwaretech.com

memory_collector

memorymodule

Library to load a DLL from memory.

metasploit-loader

A client compatible with Metasploit's staging protocol

mimikatz

A little tool to play with Windows security

mini-tor

proof-of-concept implementation of tor protocol using Microsoft CryptoAPI

monitor

The new Cuckoo Monitor.